CVE-2026-62672: Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to pregreplace(). When security.twigcontent.processenabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gravto a version that resolves this vulnerability.Fixed in 2.0.4 - Configuration
Disable Twig content processing (set security.twig_content.process_enabled to disabled) to prevent an authenticated editor from publishing a catastrophically backtracking regex pattern that can trigger ReDoS via regex_replace.
Grav Twig Sandbox (security.twig_content) security.twig_content.process_enabled = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated page editor can exploit it, but only when security.twig_content.process_enabled is enabled. The attacker can publish a Twig pattern designed to cause catastrophic regex backtracking.
Are default installations affected?
The issue depends on security.twig_content.process_enabled being enabled. The provided information does not state whether that setting is enabled by default.
What is the impact of successful exploitation?
A malicious pattern can consume PHP worker CPU, denying service to site visitors.
What should be done if an immediate upgrade is not possible?
Disable security.twig_content.process_enabled to prevent editor-controlled Twig content from reaching the vulnerable regex processing path. Restricting page-editor access also limits who can publish an exploit pattern.
Which version fixes the issue?
Grav 2.0.4 fixes this issue; versions prior to 2.0.4 are affected under the stated configuration.